rsa_eay.c revision 656d9c7f52f88b3a3daccafa7655dec086c4756e
1/* crypto/rsa/rsa_eay.c */ 2/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) 3 * All rights reserved. 4 * 5 * This package is an SSL implementation written 6 * by Eric Young (eay@cryptsoft.com). 7 * The implementation was written so as to conform with Netscapes SSL. 8 * 9 * This library is free for commercial and non-commercial use as long as 10 * the following conditions are aheared to. The following conditions 11 * apply to all code found in this distribution, be it the RC4, RSA, 12 * lhash, DES, etc., code; not just the SSL code. The SSL documentation 13 * included with this distribution is covered by the same copyright terms 14 * except that the holder is Tim Hudson (tjh@cryptsoft.com). 15 * 16 * Copyright remains Eric Young's, and as such any Copyright notices in 17 * the code are not to be removed. 18 * If this package is used in a product, Eric Young should be given attribution 19 * as the author of the parts of the library used. 20 * This can be in the form of a textual message at program startup or 21 * in documentation (online or textual) provided with the package. 22 * 23 * Redistribution and use in source and binary forms, with or without 24 * modification, are permitted provided that the following conditions 25 * are met: 26 * 1. Redistributions of source code must retain the copyright 27 * notice, this list of conditions and the following disclaimer. 28 * 2. Redistributions in binary form must reproduce the above copyright 29 * notice, this list of conditions and the following disclaimer in the 30 * documentation and/or other materials provided with the distribution. 31 * 3. All advertising materials mentioning features or use of this software 32 * must display the following acknowledgement: 33 * "This product includes cryptographic software written by 34 * Eric Young (eay@cryptsoft.com)" 35 * The word 'cryptographic' can be left out if the rouines from the library 36 * being used are not cryptographic related :-). 37 * 4. If you include any Windows specific code (or a derivative thereof) from 38 * the apps directory (application code) you must include an acknowledgement: 39 * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)" 40 * 41 * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND 42 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 43 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 44 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 45 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 46 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 47 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 48 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 49 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 50 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 51 * SUCH DAMAGE. 52 * 53 * The licence and distribution terms for any publically available version or 54 * derivative of this code cannot be changed. i.e. this code cannot simply be 55 * copied and put under another distribution licence 56 * [including the GNU Public Licence.] 57 */ 58/* ==================================================================== 59 * Copyright (c) 1998-2006 The OpenSSL Project. All rights reserved. 60 * 61 * Redistribution and use in source and binary forms, with or without 62 * modification, are permitted provided that the following conditions 63 * are met: 64 * 65 * 1. Redistributions of source code must retain the above copyright 66 * notice, this list of conditions and the following disclaimer. 67 * 68 * 2. Redistributions in binary form must reproduce the above copyright 69 * notice, this list of conditions and the following disclaimer in 70 * the documentation and/or other materials provided with the 71 * distribution. 72 * 73 * 3. All advertising materials mentioning features or use of this 74 * software must display the following acknowledgment: 75 * "This product includes software developed by the OpenSSL Project 76 * for use in the OpenSSL Toolkit. (http://www.openssl.org/)" 77 * 78 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to 79 * endorse or promote products derived from this software without 80 * prior written permission. For written permission, please contact 81 * openssl-core@openssl.org. 82 * 83 * 5. Products derived from this software may not be called "OpenSSL" 84 * nor may "OpenSSL" appear in their names without prior written 85 * permission of the OpenSSL Project. 86 * 87 * 6. Redistributions of any form whatsoever must retain the following 88 * acknowledgment: 89 * "This product includes software developed by the OpenSSL Project 90 * for use in the OpenSSL Toolkit (http://www.openssl.org/)" 91 * 92 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY 93 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 94 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 95 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR 96 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, 97 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 98 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; 99 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 100 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, 101 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 102 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED 103 * OF THE POSSIBILITY OF SUCH DAMAGE. 104 * ==================================================================== 105 * 106 * This product includes cryptographic software written by Eric Young 107 * (eay@cryptsoft.com). This product includes software written by Tim 108 * Hudson (tjh@cryptsoft.com). 109 * 110 */ 111 112#include <stdio.h> 113#include "cryptlib.h" 114#include <openssl/bn.h> 115#include <openssl/rsa.h> 116#include <openssl/rand.h> 117 118#ifndef RSA_NULL 119 120static int RSA_eay_public_encrypt(int flen, const unsigned char *from, 121 unsigned char *to, RSA *rsa,int padding); 122static int RSA_eay_private_encrypt(int flen, const unsigned char *from, 123 unsigned char *to, RSA *rsa,int padding); 124static int RSA_eay_public_decrypt(int flen, const unsigned char *from, 125 unsigned char *to, RSA *rsa,int padding); 126static int RSA_eay_private_decrypt(int flen, const unsigned char *from, 127 unsigned char *to, RSA *rsa,int padding); 128static int RSA_eay_mod_exp(BIGNUM *r0, const BIGNUM *i, RSA *rsa, BN_CTX *ctx); 129static int RSA_eay_init(RSA *rsa); 130static int RSA_eay_finish(RSA *rsa); 131static RSA_METHOD rsa_pkcs1_eay_meth={ 132 "Eric Young's PKCS#1 RSA", 133 RSA_eay_public_encrypt, 134 RSA_eay_public_decrypt, /* signature verification */ 135 RSA_eay_private_encrypt, /* signing */ 136 RSA_eay_private_decrypt, 137 RSA_eay_mod_exp, 138 BN_mod_exp_mont, /* XXX probably we should not use Montgomery if e == 3 */ 139 RSA_eay_init, 140 RSA_eay_finish, 141 0, /* flags */ 142 NULL, 143 0, /* rsa_sign */ 144 0, /* rsa_verify */ 145 NULL /* rsa_keygen */ 146 }; 147 148const RSA_METHOD *RSA_PKCS1_SSLeay(void) 149 { 150 return(&rsa_pkcs1_eay_meth); 151 } 152 153/* Usage example; 154 * MONT_HELPER(rsa->_method_mod_p, bn_ctx, rsa->p, rsa->flags & RSA_FLAG_CACHE_PRIVATE, goto err); 155 */ 156#define MONT_HELPER(method_mod, ctx, m, pre_cond, err_instr) \ 157 if ((pre_cond) && ((method_mod) == NULL) && \ 158 !BN_MONT_CTX_set_locked(&(method_mod), \ 159 CRYPTO_LOCK_RSA, \ 160 (m), (ctx))) \ 161 err_instr 162 163static int RSA_eay_public_encrypt(int flen, const unsigned char *from, 164 unsigned char *to, RSA *rsa, int padding) 165 { 166 BIGNUM *f,*ret; 167 int i,j,k,num=0,r= -1; 168 unsigned char *buf=NULL; 169 BN_CTX *ctx=NULL; 170 171 if (BN_num_bits(rsa->n) > OPENSSL_RSA_MAX_MODULUS_BITS) 172 { 173 RSAerr(RSA_F_RSA_EAY_PUBLIC_ENCRYPT, RSA_R_MODULUS_TOO_LARGE); 174 return -1; 175 } 176 177 if (BN_ucmp(rsa->n, rsa->e) <= 0) 178 { 179 RSAerr(RSA_F_RSA_EAY_PUBLIC_ENCRYPT, RSA_R_BAD_E_VALUE); 180 return -1; 181 } 182 183 /* for large moduli, enforce exponent limit */ 184 if (BN_num_bits(rsa->n) > OPENSSL_RSA_SMALL_MODULUS_BITS) 185 { 186 if (BN_num_bits(rsa->e) > OPENSSL_RSA_MAX_PUBEXP_BITS) 187 { 188 RSAerr(RSA_F_RSA_EAY_PUBLIC_ENCRYPT, RSA_R_BAD_E_VALUE); 189 return -1; 190 } 191 } 192 193 if ((ctx=BN_CTX_new()) == NULL) goto err; 194 BN_CTX_start(ctx); 195 f = BN_CTX_get(ctx); 196 ret = BN_CTX_get(ctx); 197 num=BN_num_bytes(rsa->n); 198 buf = OPENSSL_malloc(num); 199 if (!f || !ret || !buf) 200 { 201 RSAerr(RSA_F_RSA_EAY_PUBLIC_ENCRYPT,ERR_R_MALLOC_FAILURE); 202 goto err; 203 } 204 205 switch (padding) 206 { 207 case RSA_PKCS1_PADDING: 208 i=RSA_padding_add_PKCS1_type_2(buf,num,from,flen); 209 break; 210#ifndef OPENSSL_NO_SHA 211 case RSA_PKCS1_OAEP_PADDING: 212 i=RSA_padding_add_PKCS1_OAEP(buf,num,from,flen,NULL,0); 213 break; 214#endif 215 case RSA_SSLV23_PADDING: 216 i=RSA_padding_add_SSLv23(buf,num,from,flen); 217 break; 218 case RSA_NO_PADDING: 219 i=RSA_padding_add_none(buf,num,from,flen); 220 break; 221 default: 222 RSAerr(RSA_F_RSA_EAY_PUBLIC_ENCRYPT,RSA_R_UNKNOWN_PADDING_TYPE); 223 goto err; 224 } 225 if (i <= 0) goto err; 226 227 if (BN_bin2bn(buf,num,f) == NULL) goto err; 228 229 if (BN_ucmp(f, rsa->n) >= 0) 230 { 231 /* usually the padding functions would catch this */ 232 RSAerr(RSA_F_RSA_EAY_PUBLIC_ENCRYPT,RSA_R_DATA_TOO_LARGE_FOR_MODULUS); 233 goto err; 234 } 235 236 MONT_HELPER(rsa->_method_mod_n, ctx, rsa->n, rsa->flags & RSA_FLAG_CACHE_PUBLIC, goto err); 237 238 if (!rsa->meth->bn_mod_exp(ret,f,rsa->e,rsa->n,ctx, 239 rsa->_method_mod_n)) goto err; 240 241 /* put in leading 0 bytes if the number is less than the 242 * length of the modulus */ 243 j=BN_num_bytes(ret); 244 i=BN_bn2bin(ret,&(to[num-j])); 245 for (k=0; k<(num-i); k++) 246 to[k]=0; 247 248 r=num; 249err: 250 if (ctx != NULL) 251 { 252 BN_CTX_end(ctx); 253 BN_CTX_free(ctx); 254 } 255 if (buf != NULL) 256 { 257 OPENSSL_cleanse(buf,num); 258 OPENSSL_free(buf); 259 } 260 return(r); 261 } 262 263static BN_BLINDING *rsa_get_blinding(RSA *rsa, int *local, BN_CTX *ctx) 264{ 265 BN_BLINDING *ret; 266 int got_write_lock = 0; 267 268 CRYPTO_r_lock(CRYPTO_LOCK_RSA); 269 270 if (rsa->blinding == NULL) 271 { 272 CRYPTO_r_unlock(CRYPTO_LOCK_RSA); 273 CRYPTO_w_lock(CRYPTO_LOCK_RSA); 274 got_write_lock = 1; 275 276 if (rsa->blinding == NULL) 277 rsa->blinding = RSA_setup_blinding(rsa, ctx); 278 } 279 280 ret = rsa->blinding; 281 if (ret == NULL) 282 goto err; 283 284 if (BN_BLINDING_get_thread_id(ret) == CRYPTO_thread_id()) 285 { 286 /* rsa->blinding is ours! */ 287 288 *local = 1; 289 } 290 else 291 { 292 /* resort to rsa->mt_blinding instead */ 293 294 *local = 0; /* instructs rsa_blinding_convert(), rsa_blinding_invert() 295 * that the BN_BLINDING is shared, meaning that accesses 296 * require locks, and that the blinding factor must be 297 * stored outside the BN_BLINDING 298 */ 299 300 if (rsa->mt_blinding == NULL) 301 { 302 if (!got_write_lock) 303 { 304 CRYPTO_r_unlock(CRYPTO_LOCK_RSA); 305 CRYPTO_w_lock(CRYPTO_LOCK_RSA); 306 got_write_lock = 1; 307 } 308 309 if (rsa->mt_blinding == NULL) 310 rsa->mt_blinding = RSA_setup_blinding(rsa, ctx); 311 } 312 ret = rsa->mt_blinding; 313 } 314 315 err: 316 if (got_write_lock) 317 CRYPTO_w_unlock(CRYPTO_LOCK_RSA); 318 else 319 CRYPTO_r_unlock(CRYPTO_LOCK_RSA); 320 return ret; 321} 322 323static int rsa_blinding_convert(BN_BLINDING *b, int local, BIGNUM *f, 324 BIGNUM *r, BN_CTX *ctx) 325{ 326 if (local) 327 return BN_BLINDING_convert_ex(f, NULL, b, ctx); 328 else 329 { 330 int ret; 331 CRYPTO_r_lock(CRYPTO_LOCK_RSA_BLINDING); 332 ret = BN_BLINDING_convert_ex(f, r, b, ctx); 333 CRYPTO_r_unlock(CRYPTO_LOCK_RSA_BLINDING); 334 return ret; 335 } 336} 337 338static int rsa_blinding_invert(BN_BLINDING *b, int local, BIGNUM *f, 339 BIGNUM *r, BN_CTX *ctx) 340{ 341 if (local) 342 return BN_BLINDING_invert_ex(f, NULL, b, ctx); 343 else 344 { 345 int ret; 346 CRYPTO_w_lock(CRYPTO_LOCK_RSA_BLINDING); 347 ret = BN_BLINDING_invert_ex(f, r, b, ctx); 348 CRYPTO_w_unlock(CRYPTO_LOCK_RSA_BLINDING); 349 return ret; 350 } 351} 352 353/* signing */ 354static int RSA_eay_private_encrypt(int flen, const unsigned char *from, 355 unsigned char *to, RSA *rsa, int padding) 356 { 357 BIGNUM *f, *ret, *br, *res; 358 int i,j,k,num=0,r= -1; 359 unsigned char *buf=NULL; 360 BN_CTX *ctx=NULL; 361 int local_blinding = 0; 362 BN_BLINDING *blinding = NULL; 363 364 if ((ctx=BN_CTX_new()) == NULL) goto err; 365 BN_CTX_start(ctx); 366 f = BN_CTX_get(ctx); 367 br = BN_CTX_get(ctx); 368 ret = BN_CTX_get(ctx); 369 num = BN_num_bytes(rsa->n); 370 buf = OPENSSL_malloc(num); 371 if(!f || !ret || !buf) 372 { 373 RSAerr(RSA_F_RSA_EAY_PRIVATE_ENCRYPT,ERR_R_MALLOC_FAILURE); 374 goto err; 375 } 376 377 switch (padding) 378 { 379 case RSA_PKCS1_PADDING: 380 i=RSA_padding_add_PKCS1_type_1(buf,num,from,flen); 381 break; 382 case RSA_X931_PADDING: 383 i=RSA_padding_add_X931(buf,num,from,flen); 384 break; 385 case RSA_NO_PADDING: 386 i=RSA_padding_add_none(buf,num,from,flen); 387 break; 388 case RSA_SSLV23_PADDING: 389 default: 390 RSAerr(RSA_F_RSA_EAY_PRIVATE_ENCRYPT,RSA_R_UNKNOWN_PADDING_TYPE); 391 goto err; 392 } 393 if (i <= 0) goto err; 394 395 if (BN_bin2bn(buf,num,f) == NULL) goto err; 396 397 if (BN_ucmp(f, rsa->n) >= 0) 398 { 399 /* usually the padding functions would catch this */ 400 RSAerr(RSA_F_RSA_EAY_PRIVATE_ENCRYPT,RSA_R_DATA_TOO_LARGE_FOR_MODULUS); 401 goto err; 402 } 403 404 if (!(rsa->flags & RSA_FLAG_NO_BLINDING)) 405 { 406 blinding = rsa_get_blinding(rsa, &local_blinding, ctx); 407 if (blinding == NULL) 408 { 409 RSAerr(RSA_F_RSA_EAY_PRIVATE_ENCRYPT, ERR_R_INTERNAL_ERROR); 410 goto err; 411 } 412 } 413 414 if (blinding != NULL) 415 if (!rsa_blinding_convert(blinding, local_blinding, f, br, ctx)) 416 goto err; 417 418 if ( (rsa->flags & RSA_FLAG_EXT_PKEY) || 419 ((rsa->p != NULL) && 420 (rsa->q != NULL) && 421 (rsa->dmp1 != NULL) && 422 (rsa->dmq1 != NULL) && 423 (rsa->iqmp != NULL)) ) 424 { 425 if (!rsa->meth->rsa_mod_exp(ret, f, rsa, ctx)) goto err; 426 } 427 else 428 { 429 BIGNUM local_d; 430 BIGNUM *d = NULL; 431 432 if (!(rsa->flags & RSA_FLAG_NO_CONSTTIME)) 433 { 434 BN_init(&local_d); 435 d = &local_d; 436 BN_with_flags(d, rsa->d, BN_FLG_CONSTTIME); 437 } 438 else 439 d= rsa->d; 440 441 MONT_HELPER(rsa->_method_mod_n, ctx, rsa->n, rsa->flags & RSA_FLAG_CACHE_PUBLIC, goto err); 442 443 if (!rsa->meth->bn_mod_exp(ret,f,d,rsa->n,ctx, 444 rsa->_method_mod_n)) goto err; 445 } 446 447 if (blinding) 448 if (!rsa_blinding_invert(blinding, local_blinding, ret, br, ctx)) 449 goto err; 450 451 if (padding == RSA_X931_PADDING) 452 { 453 BN_sub(f, rsa->n, ret); 454 if (BN_cmp(ret, f)) 455 res = f; 456 else 457 res = ret; 458 } 459 else 460 res = ret; 461 462 /* put in leading 0 bytes if the number is less than the 463 * length of the modulus */ 464 j=BN_num_bytes(res); 465 i=BN_bn2bin(res,&(to[num-j])); 466 for (k=0; k<(num-i); k++) 467 to[k]=0; 468 469 r=num; 470err: 471 if (ctx != NULL) 472 { 473 BN_CTX_end(ctx); 474 BN_CTX_free(ctx); 475 } 476 if (buf != NULL) 477 { 478 OPENSSL_cleanse(buf,num); 479 OPENSSL_free(buf); 480 } 481 return(r); 482 } 483 484static int RSA_eay_private_decrypt(int flen, const unsigned char *from, 485 unsigned char *to, RSA *rsa, int padding) 486 { 487 BIGNUM *f, *ret, *br; 488 int j,num=0,r= -1; 489 unsigned char *p; 490 unsigned char *buf=NULL; 491 BN_CTX *ctx=NULL; 492 int local_blinding = 0; 493 BN_BLINDING *blinding = NULL; 494 495 if((ctx = BN_CTX_new()) == NULL) goto err; 496 BN_CTX_start(ctx); 497 f = BN_CTX_get(ctx); 498 br = BN_CTX_get(ctx); 499 ret = BN_CTX_get(ctx); 500 num = BN_num_bytes(rsa->n); 501 buf = OPENSSL_malloc(num); 502 if(!f || !ret || !buf) 503 { 504 RSAerr(RSA_F_RSA_EAY_PRIVATE_DECRYPT,ERR_R_MALLOC_FAILURE); 505 goto err; 506 } 507 508 /* This check was for equality but PGP does evil things 509 * and chops off the top '0' bytes */ 510 if (flen > num) 511 { 512 RSAerr(RSA_F_RSA_EAY_PRIVATE_DECRYPT,RSA_R_DATA_GREATER_THAN_MOD_LEN); 513 goto err; 514 } 515 516 /* make data into a big number */ 517 if (BN_bin2bn(from,(int)flen,f) == NULL) goto err; 518 519 if (BN_ucmp(f, rsa->n) >= 0) 520 { 521 RSAerr(RSA_F_RSA_EAY_PRIVATE_DECRYPT,RSA_R_DATA_TOO_LARGE_FOR_MODULUS); 522 goto err; 523 } 524 525 if (!(rsa->flags & RSA_FLAG_NO_BLINDING)) 526 { 527 blinding = rsa_get_blinding(rsa, &local_blinding, ctx); 528 if (blinding == NULL) 529 { 530 RSAerr(RSA_F_RSA_EAY_PRIVATE_DECRYPT, ERR_R_INTERNAL_ERROR); 531 goto err; 532 } 533 } 534 535 if (blinding != NULL) 536 if (!rsa_blinding_convert(blinding, local_blinding, f, br, ctx)) 537 goto err; 538 539 /* do the decrypt */ 540 if ( (rsa->flags & RSA_FLAG_EXT_PKEY) || 541 ((rsa->p != NULL) && 542 (rsa->q != NULL) && 543 (rsa->dmp1 != NULL) && 544 (rsa->dmq1 != NULL) && 545 (rsa->iqmp != NULL)) ) 546 { 547 if (!rsa->meth->rsa_mod_exp(ret, f, rsa, ctx)) goto err; 548 } 549 else 550 { 551 BIGNUM local_d; 552 BIGNUM *d = NULL; 553 554 if (!(rsa->flags & RSA_FLAG_NO_CONSTTIME)) 555 { 556 d = &local_d; 557 BN_with_flags(d, rsa->d, BN_FLG_CONSTTIME); 558 } 559 else 560 d = rsa->d; 561 562 MONT_HELPER(rsa->_method_mod_n, ctx, rsa->n, rsa->flags & RSA_FLAG_CACHE_PUBLIC, goto err); 563 if (!rsa->meth->bn_mod_exp(ret,f,d,rsa->n,ctx, 564 rsa->_method_mod_n)) 565 goto err; 566 } 567 568 if (blinding) 569 if (!rsa_blinding_invert(blinding, local_blinding, ret, br, ctx)) 570 goto err; 571 572 p=buf; 573 j=BN_bn2bin(ret,p); /* j is only used with no-padding mode */ 574 575 switch (padding) 576 { 577 case RSA_PKCS1_PADDING: 578 r=RSA_padding_check_PKCS1_type_2(to,num,buf,j,num); 579 break; 580#ifndef OPENSSL_NO_SHA 581 case RSA_PKCS1_OAEP_PADDING: 582 r=RSA_padding_check_PKCS1_OAEP(to,num,buf,j,num,NULL,0); 583 break; 584#endif 585 case RSA_SSLV23_PADDING: 586 r=RSA_padding_check_SSLv23(to,num,buf,j,num); 587 break; 588 case RSA_NO_PADDING: 589 r=RSA_padding_check_none(to,num,buf,j,num); 590 break; 591 default: 592 RSAerr(RSA_F_RSA_EAY_PRIVATE_DECRYPT,RSA_R_UNKNOWN_PADDING_TYPE); 593 goto err; 594 } 595 if (r < 0) 596 RSAerr(RSA_F_RSA_EAY_PRIVATE_DECRYPT,RSA_R_PADDING_CHECK_FAILED); 597 598err: 599 if (ctx != NULL) 600 { 601 BN_CTX_end(ctx); 602 BN_CTX_free(ctx); 603 } 604 if (buf != NULL) 605 { 606 OPENSSL_cleanse(buf,num); 607 OPENSSL_free(buf); 608 } 609 return(r); 610 } 611 612/* signature verification */ 613static int RSA_eay_public_decrypt(int flen, const unsigned char *from, 614 unsigned char *to, RSA *rsa, int padding) 615 { 616 BIGNUM *f,*ret; 617 int i,num=0,r= -1; 618 unsigned char *p; 619 unsigned char *buf=NULL; 620 BN_CTX *ctx=NULL; 621 622 if (BN_num_bits(rsa->n) > OPENSSL_RSA_MAX_MODULUS_BITS) 623 { 624 RSAerr(RSA_F_RSA_EAY_PUBLIC_DECRYPT, RSA_R_MODULUS_TOO_LARGE); 625 return -1; 626 } 627 628 if (BN_ucmp(rsa->n, rsa->e) <= 0) 629 { 630 RSAerr(RSA_F_RSA_EAY_PUBLIC_DECRYPT, RSA_R_BAD_E_VALUE); 631 return -1; 632 } 633 634 /* for large moduli, enforce exponent limit */ 635 if (BN_num_bits(rsa->n) > OPENSSL_RSA_SMALL_MODULUS_BITS) 636 { 637 if (BN_num_bits(rsa->e) > OPENSSL_RSA_MAX_PUBEXP_BITS) 638 { 639 RSAerr(RSA_F_RSA_EAY_PUBLIC_DECRYPT, RSA_R_BAD_E_VALUE); 640 return -1; 641 } 642 } 643 644 if((ctx = BN_CTX_new()) == NULL) goto err; 645 BN_CTX_start(ctx); 646 f = BN_CTX_get(ctx); 647 ret = BN_CTX_get(ctx); 648 num=BN_num_bytes(rsa->n); 649 buf = OPENSSL_malloc(num); 650 if(!f || !ret || !buf) 651 { 652 RSAerr(RSA_F_RSA_EAY_PUBLIC_DECRYPT,ERR_R_MALLOC_FAILURE); 653 goto err; 654 } 655 656 /* This check was for equality but PGP does evil things 657 * and chops off the top '0' bytes */ 658 if (flen > num) 659 { 660 RSAerr(RSA_F_RSA_EAY_PUBLIC_DECRYPT,RSA_R_DATA_GREATER_THAN_MOD_LEN); 661 goto err; 662 } 663 664 if (BN_bin2bn(from,flen,f) == NULL) goto err; 665 666 if (BN_ucmp(f, rsa->n) >= 0) 667 { 668 RSAerr(RSA_F_RSA_EAY_PUBLIC_DECRYPT,RSA_R_DATA_TOO_LARGE_FOR_MODULUS); 669 goto err; 670 } 671 672 MONT_HELPER(rsa->_method_mod_n, ctx, rsa->n, rsa->flags & RSA_FLAG_CACHE_PUBLIC, goto err); 673 674 if (!rsa->meth->bn_mod_exp(ret,f,rsa->e,rsa->n,ctx, 675 rsa->_method_mod_n)) goto err; 676 677 if ((padding == RSA_X931_PADDING) && ((ret->d[0] & 0xf) != 12)) 678 BN_sub(ret, rsa->n, ret); 679 680 p=buf; 681 i=BN_bn2bin(ret,p); 682 683 switch (padding) 684 { 685 case RSA_PKCS1_PADDING: 686 r=RSA_padding_check_PKCS1_type_1(to,num,buf,i,num); 687 break; 688 case RSA_X931_PADDING: 689 r=RSA_padding_check_X931(to,num,buf,i,num); 690 break; 691 case RSA_NO_PADDING: 692 r=RSA_padding_check_none(to,num,buf,i,num); 693 break; 694 default: 695 RSAerr(RSA_F_RSA_EAY_PUBLIC_DECRYPT,RSA_R_UNKNOWN_PADDING_TYPE); 696 goto err; 697 } 698 if (r < 0) 699 RSAerr(RSA_F_RSA_EAY_PUBLIC_DECRYPT,RSA_R_PADDING_CHECK_FAILED); 700 701err: 702 if (ctx != NULL) 703 { 704 BN_CTX_end(ctx); 705 BN_CTX_free(ctx); 706 } 707 if (buf != NULL) 708 { 709 OPENSSL_cleanse(buf,num); 710 OPENSSL_free(buf); 711 } 712 return(r); 713 } 714 715static int RSA_eay_mod_exp(BIGNUM *r0, const BIGNUM *I, RSA *rsa, BN_CTX *ctx) 716 { 717 BIGNUM *r1,*m1,*vrfy; 718 BIGNUM local_dmp1,local_dmq1,local_c,local_r1; 719 BIGNUM *dmp1,*dmq1,*c,*pr1; 720 int ret=0; 721 722 BN_CTX_start(ctx); 723 r1 = BN_CTX_get(ctx); 724 m1 = BN_CTX_get(ctx); 725 vrfy = BN_CTX_get(ctx); 726 727 { 728 BIGNUM local_p, local_q; 729 BIGNUM *p = NULL, *q = NULL; 730 731 /* Make sure BN_mod_inverse in Montgomery intialization uses the 732 * BN_FLG_CONSTTIME flag (unless RSA_FLAG_NO_CONSTTIME is set) 733 */ 734 if (!(rsa->flags & RSA_FLAG_NO_CONSTTIME)) 735 { 736 BN_init(&local_p); 737 p = &local_p; 738 BN_with_flags(p, rsa->p, BN_FLG_CONSTTIME); 739 740 BN_init(&local_q); 741 q = &local_q; 742 BN_with_flags(q, rsa->q, BN_FLG_CONSTTIME); 743 } 744 else 745 { 746 p = rsa->p; 747 q = rsa->q; 748 } 749 750 MONT_HELPER(rsa->_method_mod_p, ctx, p, rsa->flags & RSA_FLAG_CACHE_PRIVATE, goto err); 751 MONT_HELPER(rsa->_method_mod_q, ctx, q, rsa->flags & RSA_FLAG_CACHE_PRIVATE, goto err); 752 } 753 754 MONT_HELPER(rsa->_method_mod_n, ctx, rsa->n, rsa->flags & RSA_FLAG_CACHE_PUBLIC, goto err); 755 756 /* compute I mod q */ 757 if (!(rsa->flags & RSA_FLAG_NO_CONSTTIME)) 758 { 759 c = &local_c; 760 BN_with_flags(c, I, BN_FLG_CONSTTIME); 761 if (!BN_mod(r1,c,rsa->q,ctx)) goto err; 762 } 763 else 764 { 765 if (!BN_mod(r1,I,rsa->q,ctx)) goto err; 766 } 767 768 /* compute r1^dmq1 mod q */ 769 if (!(rsa->flags & RSA_FLAG_NO_CONSTTIME)) 770 { 771 dmq1 = &local_dmq1; 772 BN_with_flags(dmq1, rsa->dmq1, BN_FLG_CONSTTIME); 773 } 774 else 775 dmq1 = rsa->dmq1; 776 if (!rsa->meth->bn_mod_exp(m1,r1,dmq1,rsa->q,ctx, 777 rsa->_method_mod_q)) goto err; 778 779 /* compute I mod p */ 780 if (!(rsa->flags & RSA_FLAG_NO_CONSTTIME)) 781 { 782 c = &local_c; 783 BN_with_flags(c, I, BN_FLG_CONSTTIME); 784 if (!BN_mod(r1,c,rsa->p,ctx)) goto err; 785 } 786 else 787 { 788 if (!BN_mod(r1,I,rsa->p,ctx)) goto err; 789 } 790 791 /* compute r1^dmp1 mod p */ 792 if (!(rsa->flags & RSA_FLAG_NO_CONSTTIME)) 793 { 794 dmp1 = &local_dmp1; 795 BN_with_flags(dmp1, rsa->dmp1, BN_FLG_CONSTTIME); 796 } 797 else 798 dmp1 = rsa->dmp1; 799 if (!rsa->meth->bn_mod_exp(r0,r1,dmp1,rsa->p,ctx, 800 rsa->_method_mod_p)) goto err; 801 802 if (!BN_sub(r0,r0,m1)) goto err; 803 /* This will help stop the size of r0 increasing, which does 804 * affect the multiply if it optimised for a power of 2 size */ 805 if (BN_is_negative(r0)) 806 if (!BN_add(r0,r0,rsa->p)) goto err; 807 808 if (!BN_mul(r1,r0,rsa->iqmp,ctx)) goto err; 809 810 /* Turn BN_FLG_CONSTTIME flag on before division operation */ 811 if (!(rsa->flags & RSA_FLAG_NO_CONSTTIME)) 812 { 813 pr1 = &local_r1; 814 BN_with_flags(pr1, r1, BN_FLG_CONSTTIME); 815 } 816 else 817 pr1 = r1; 818 if (!BN_mod(r0,pr1,rsa->p,ctx)) goto err; 819 820 /* If p < q it is occasionally possible for the correction of 821 * adding 'p' if r0 is negative above to leave the result still 822 * negative. This can break the private key operations: the following 823 * second correction should *always* correct this rare occurrence. 824 * This will *never* happen with OpenSSL generated keys because 825 * they ensure p > q [steve] 826 */ 827 if (BN_is_negative(r0)) 828 if (!BN_add(r0,r0,rsa->p)) goto err; 829 if (!BN_mul(r1,r0,rsa->q,ctx)) goto err; 830 if (!BN_add(r0,r1,m1)) goto err; 831 832 if (rsa->e && rsa->n) 833 { 834 if (!rsa->meth->bn_mod_exp(vrfy,r0,rsa->e,rsa->n,ctx,rsa->_method_mod_n)) goto err; 835 /* If 'I' was greater than (or equal to) rsa->n, the operation 836 * will be equivalent to using 'I mod n'. However, the result of 837 * the verify will *always* be less than 'n' so we don't check 838 * for absolute equality, just congruency. */ 839 if (!BN_sub(vrfy, vrfy, I)) goto err; 840 if (!BN_mod(vrfy, vrfy, rsa->n, ctx)) goto err; 841 if (BN_is_negative(vrfy)) 842 if (!BN_add(vrfy, vrfy, rsa->n)) goto err; 843 if (!BN_is_zero(vrfy)) 844 { 845 /* 'I' and 'vrfy' aren't congruent mod n. Don't leak 846 * miscalculated CRT output, just do a raw (slower) 847 * mod_exp and return that instead. */ 848 849 BIGNUM local_d; 850 BIGNUM *d = NULL; 851 852 if (!(rsa->flags & RSA_FLAG_NO_CONSTTIME)) 853 { 854 d = &local_d; 855 BN_with_flags(d, rsa->d, BN_FLG_CONSTTIME); 856 } 857 else 858 d = rsa->d; 859 if (!rsa->meth->bn_mod_exp(r0,I,d,rsa->n,ctx, 860 rsa->_method_mod_n)) goto err; 861 } 862 } 863 ret=1; 864err: 865 BN_CTX_end(ctx); 866 return(ret); 867 } 868 869static int RSA_eay_init(RSA *rsa) 870 { 871 rsa->flags|=RSA_FLAG_CACHE_PUBLIC|RSA_FLAG_CACHE_PRIVATE; 872 return(1); 873 } 874 875static int RSA_eay_finish(RSA *rsa) 876 { 877 if (rsa->_method_mod_n != NULL) 878 BN_MONT_CTX_free(rsa->_method_mod_n); 879 if (rsa->_method_mod_p != NULL) 880 BN_MONT_CTX_free(rsa->_method_mod_p); 881 if (rsa->_method_mod_q != NULL) 882 BN_MONT_CTX_free(rsa->_method_mod_q); 883 return(1); 884 } 885 886#endif 887